CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...

PT-2026-78893

Name of the Vulnerable Software and Affected Versions GutenKit versions prior to 2.5.0 Description Insufficient capability checks on certain REST API endpoints allow users with the Contributor role or higher to retrieve mailing-list audience metadata from the connected marketing account...

CVE-2026-65709: Authorization Bypass Through User-Controlled Key

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

Substack Breach: 662,752 User Records Leaked on Cybercrime Forum

Substack confirms a breach after hacker accessed internal user records now circulating on crime forums, exposing emails, phone numbers, and account metadata...

keycloak: Account REST API can update user metadata attributes

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

Code injection

EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcpmember API call...

CVE-2016-0886

CVE-2016-0886 affects EMC Documentum xCP (versions 2.1 before patch 24 and 2.2 before patch 12). The vulnerability allows remote authenticated users to disclose sensitive user-account metadata via the members/xcp_member API. Root cause is an information-disclosure issue in that API endpoint. Impa...